ContextCore is currently designed for local-first, single-user desktop usage.

• Backend and MCP endpoints bind to 127.0.0.1 by default.
• REST and MCP endpoints do not yet implement login/session authentication.
• The local threat model assumes you do not expose port 8420 to a LAN or the public internet.
• Any local process on the same machine may be able to call the local API if it can reach 127.0.0.1:8420.

ContextCore is safe by default:

• Agents can read context and propose drafts.
• Official knowledge writes, delete requests, and stale marks require user review by default.
• Direct writes/deletes are advanced opt-in behavior and require both the Agent permission and knowledge-type policy to be set to allow.

• Do not commit .env files or real API keys.
• CONTEXTCORE_OPENCLAW_BRIDGE_SECRET can be set to pin the OpenClaw bridge secret. If unset, the app generates a random secret for the process.
• Optional OpenAI-compatible keys are used only for LLM/embedding features. Core local search and MCP access continue without them.

Please open a private report if the repository is private, or a GitHub Security Advisory if the repository is public. Include:

• ContextCore version or commit hash.
• Operating system.
• Whether the issue affects REST API, MCP tools, backup/restore, local files, or desktop packaging.
• Minimal reproduction steps.